What Is a SIM Swap Attack?
Key takeaways
- A SIM swap is a carrier-level fraud, so most of the protection sits with the operator and with how you register your number, not with your laptop.
- Once the number moves, every SMS one-time password reaches the attacker, which is why banking, UPI, email and password resets all fail at once.
- Ask your carrier to register the number against your Aadhaar or PAN and to enable a porting lock, which blocks a change without a fresh request from you.
- Keep an alternate contact method on every important account, because a company email address you can still reach is the way back in after a swap.
- Move critical logins off SMS entirely, using passkeys, authenticator apps or hardware keys, so a stolen number is not a stolen account.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is a SIM swap attack and how does it work in India?
Your mobile number is an identity document in practice, and that is the problem. In a SIM swap, an attacker uses forged documents, insider influence at a retailer, or a social-engineered call to the carrier to request a change of SIM or a change of registered address, so the existing number is transferred to a new card or a new eSIM profile. From that point the attacker's device receives your SMS. That includes banking OTPs, UPI collect requests, delivery notifications, and every password reset sent by text.
What are the warning signs of a SIM swap?
Watch for a sudden loss of signal on a phone that was working, calls that drop, SMS messages that stop arriving while data still works, and a sudden change in the phone's network name or a new carrier notification. If money is missing, a bank alert you did not trigger, or a password reset email for a service you did not use, treat the number as compromised. Do not simply buy a new SIM and carry on, because the attacker still holds the old number. Report to the carrier the same day, ask them to reverse the swap and log the complaint, and rotate every account that used SMS.
How do you stop a SIM swap happening to your number?
Four actions, in order. Register your number properly with your carrier against your Aadhaar or PAN, so that a change of SIM needs a fresh request from you and a document check. Ask for a porting lock, which stops a change of registered address without your written request, and confirm in writing that it is active. Set a DND and the carrier's own alerts for any change to your number, so a swap is visible to you before it is used. And add a second, non-SMS recovery path to every important account, such as a company email address or a passkey, so the number is not the only key to the account.
What should a company do when a number is compromised?
Assume every account tied to that number is affected and work in a fixed order. First, call the carrier and get the swap reversed, with a reference number, because until the number is yours again, every reset code goes to the attacker. Second, notify the bank fraud team and the payment platform, and if money moved, file on cybercrime.gov.in and the 1930 helpline. Third, reset the credentials on every account that used SMS, starting with email, because email is the recovery path for everything else. Fourth, review the account's recent activity for new payees, new forwarders and new sign-in locations. Write the report while the facts are fresh.
| Layer | Who acts | What it stops | Time to act |
|---|---|---|---|
| Number registered against Aadhaar or PAN | You and the carrier | Document-fraud swaps | One-time setup |
| Porting lock | The carrier | Change of registered address | One-time setup |
| Carrier alerts on SIM change | The carrier | Silent swaps | Immediate |
| Ported number moved off SMS logins | You and each service | OTP-based takeover | Per account |
| Alternate recovery channel | You and each service | Account reset via the stolen number | Per account |
| Reversal and fraud complaint | Carrier and bank | Continued financial loss | Same day |
What are the frequently asked questions?
Get a straight answer on this
Send us the list of accounts that use SMS codes for sign-in, and we will return a fixed-price plan to move the critical ones to passkeys with a documented carrier-side setup.
Send us the details See pricing